In October 1980, John Moore was treated at the UCLA Medical Centre for hairy-cell leukaemia, a type of blood cancer. His spleen was removed through surgery (splenectomy). Later, his doctors used some of the cells from his removed spleen to create a commercially valuable cell line. This cell line eventually earned hundreds of millions of dollars in licensing revenue, but Moore did not know about it or give his consent. For the past four decades, legal scholars have been troubled by the California Supreme Court's ruling in: Moore v. Regents of University of California (1990). In that case, Moore sued the Regents of the University of California. He could take legal action for breach of fiduciary duty. He was unable to assert ownership.

India has never experienced anything like Moore's moment. Exactly this is the problem.

As genetic testing becomes accessible through ancestry platforms, clinical diagnostics, employer wellness programmes, and law enforcement databases, the question of who owns your DNA has migrated from bioethics seminars into courtrooms, boardrooms, and police stations. There is no clear answer in Indian law. Rather, what we have is a silence: a data protection law that does not treat genetic data as sensitive; a property law framework designed for land & goods; a transplant law that requires genetic testing without a disclosure protocol; and criminal investigation architecture that indefinitely collects DNA without an oversight board. These silences do not add up to neutrality. It silently vacates the premises.

The Property Law Dead End

When faced with a new entitlement question, the instinct is to reach for property law. If DNA is yours in any meaningful sense, it is surely property something you own, can transfer, and can exclude others from using.

Are DNA Strands Actually Your Property? There is little gain to acquire under Indian property law.

The Transfer of Property Act, 1882 considers property to be either immovable (noun and attached fixtures) or movable (goods). Human biological materials do not fit into either of these categories. It may be argued that once a clinical sample is taken from a person it becomes an article, however, the Act has never been construed to confer property rights over the person from whose body it was taken. At sporadic moments, courts have had the occasion to consider human body parts in connection to medical waste, transplant logistics and post-mortem rights. However, no Indian court has either held or suggested that a living person has a property interest in their own cells, genes or biological derivatives once they leave the body.

The instinct, when confronted with a novel entitlement question, is to reach for property law. If DNA is yours in any meaningful sense, surely it is property something you own, can transfer, and can exclude others from using. Indian property law offers almost no purchase here.

The Patents Act, 1970 compounds the difficulty from the other direction. Section 3(b) excludes inventions contrary to public order or morality, and Section 3(j) prohibits patents on plants and animals but its treatment of human genetic sequences has been deliberately ambiguous. The 2002 amendment that brought India's regime closer to TRIPS left open whether isolated gene sequences could be patented, a question that the United States resolved (however controversially) in Association for Molecular Pathology v. Myriad Genetics (2013) by holding that naturally occurring DNA sequences are not patentable subject matter. India has no equivalent ruling. Pharmaceutical companies and research institutions have filed patents on genetic sequences derived from Indian populations. Whether the individuals whose genomes provided that data retain any legal claim over the resulting intellectual property is, to put it plainly, unanswered.

The DPDPA's Telling Omission

One might expect India's flagship privacy statute the Digital Personal Data Protection Act, 2023 to fill some of this gap. It does not.

The DPDPA operates on a single-tier model of personal data. It recognises certain categories of “sensitive personal data” for which additional protections may be specified by the Central Government through rules but the Act itself does not define what those categories are. This is a structural choice with consequences. By contrast, the European Union's General Data Protection Regulation (GDPR) explicitly classifies genetic data and biometric data processed for unique identification as special category data under Article 9, prohibiting their processing except under strictly enumerated conditions. The United Kingdom's UK GDPR maintains the same classification. India's statute defers this categorisation entirely to subordinate legislation that, as of the time of writing, has not been finalised.

The practical result is that a direct-to-consumer genetic testing company, a diagnostic laboratory, a research institution, or a law enforcement agency processing an Indian citizen's entire genomic sequence is subject to the same standard of data protection as a platform storing an email address. Genetic data is not merely more sensitive than other personal data in degree it is different in kind. It is heritable. It identifies not just the individual but their biological relatives across generations. It is immutable; unlike a password or even a biometric scan, you cannot revoke your genetic sequence. And it can reveal without any additional input predispositions to disease, ancestry, ethnicity, and in some contested scientific frameworks, behavioural characteristics.

None of this analytical structure finds expression in the DPDPA.

The Criminal Investigation Architecture

The Criminal Procedure (Identification) Act, 2022 which replaced the Identification of Prisoners Act, 1920 authorises the collection of “measurements” from arrested persons, convicted persons, and in certain circumstances, persons not arrested at all. The term “measurements” is defined to include biological samples and their analysis. DNA profiling falls within this architecture.

The data collected is to be retained by the National Crime Records Bureau for 75 years. There is no independent regulatory board overseeing the database the DNA Technology (Use and Application) Regulation Bill, 2019, which had proposed a DNA Regulatory Board with oversight, accreditation, and expungement functions, was withdrawn. Its safeguards were never legislated.

What remains is a collection mechanism without an accountability structure. The 75-year retention period means that a person arrested but never charged, or acquitted has their genetic information stored for effectively their entire lifetime. S. and Marper v. United Kingdom (2008) led the European Court of Human Rights to hold that indefinite retention of DNA profiles of acquitted persons violated Article 8 of the European Convention on Human Rights. India's framework is, if anything, less protective acquitted persons must apply for data destruction, and no automatic deletion follows acquittal.

But the Identification Act raises a question that goes deeper than retention: it presupposes that the State's right to take and use genetic information, once triggered by arrest, overrides any continuing proprietary or privacy interest the individual has in their own genetic data. That presupposition has never been subjected to constitutional scrutiny in India. The Puttaswamy proportionality framework legality, legitimate aim, proportionality, procedural safeguards applies as much to the use of genetic data as to any other form of surveillance. The criminal procedure architecture, built before that framework was fully articulated, has not been tested against it.

Towards a Sui Generis Framework

The Moore decision was wrong not because the California court misread California property law, but because it applied the wrong conceptual category. The question of what a person is owed for the downstream commercial and institutional use of their genetic material is not a property law question. It is a sovereignty question.

The concept of genetic sovereignty the idea that each individual retains an inalienable right to control the generation, storage, analysis, sharing, and commercialisation of information derived from their genome does not sit comfortably in any single existing legal framework. It is not reducible to privacy, which concerns informational control but does not speak to proprietary returns. It is not reducible to property, which speaks to ownership but not to the deeply personal character of genetic information. It is not reducible to bodily integrity, which addresses physical interference but not the informational derivatives that outlive the physical sample.

What is needed is a sui generis statutory framework for genetic sovereignty. Such a framework would need to accomplish at minimum four things.

First, it must classify genetic data as a special category with heightened protection a function the DPDPA 2023 has deferred to rules and which those rules must now urgently perform. Genetic data should be subject to an explicit purpose-limitation principle: data collected for diagnostic purposes cannot be re-used for law enforcement; data collected for research cannot be commercially sublicensed without the individual's specific, informed consent for that specific sublicensing.

Second, it must create a statutory right to genetic non-discrimination. The United States enacted the Genetic Information Nondiscrimination Act (GINA) in 2008, prohibiting the use of genetic information in employment and health insurance decisions. No equivalent legislation exists in India. Employers can lawfully demand genetic screening; insurers can deny coverage on the basis of genetic predisposition. The constitutional prohibition on discrimination in Articles 15 and 16 operates against the State, not private actors, and the common law of contract provides no meaningful safeguard.

Third, it must resolve the criminal procedure lacuna. DNA collected under the Criminal Procedure (Identification) Act must be subject to automatic expungement upon acquittal, a statutory prohibition on familial searching without prior judicial authorisation, and an independent oversight board with meaningful power to audit, accredit, and discipline.

Fourth, it must address the commercial dimension that Moore failed to resolve. When a private company generates commercial value from genomic data contributed by Indian citizens whether through a research partnership, a drug development pipeline, or a commercial database those citizens currently receive nothing: no royalty, no attribution, no entitlement to share in the value their genetic information created. The Biological Diversity Act, 2002 and its benefit-sharing framework address biodiversity at a community level but do not reach individual genomic contributions. A benefit-sharing mechanism for genetic data structured not as property but as a statutory entitlement is both legally feasible and morally necessary.

The title of this piece is deliberately provocative. Your DNA is not your property not because you have no claim over it, but because property law is the wrong lens entirely. The question is not whether you own your genome but whether you have sovereignty over it: the right to decide who uses it, for what, for how long, and with what return.

Indian law currently answers that question with silence. The DPDPA 2023 defers it to rules that do not exist. The criminal procedure framework overrides it by design. The property law framework has no vocabulary for it. And the legislature has not thought it worth addressing directly in any standalone statute.

That silence is not a neutral position. It is a choice one that systematically favours the institutions (commercial, state, and scientific) that extract value from genetic information over the individuals from whose bodies that information originates. Rethinking genetic ownership in India does not require importing Moore's property framework and applying it. It requires building something new: a legal conception of the human genome as a site of constitutional sovereignty, not commercial resource.

The cells do not wait for the law to catch up.

Author is an Assistant Professor at School of Law, CHRIST (Deemed to be University), Delhi NCR Campus. Views are personal.